[aidenybai]

Why

Native Node path strings can contain RegExp metacharacters. This adds a finite check for an unescaped native path used as leading literal text in a RegExp pattern.

What changed

• Recognize direct closed path.resolve namespace calls, supported fs.realpathSync composition, exact separator normalization, and at most two readonly result bindings. Keep existing rule routes and unsupported provider, transport, selector, and wrapper boundaries.
• Resolve real runtime bindings separately from erased TypeScript declarations. Preserve genuine local intrinsic shadows and reject destructuring assignment targets as writes.
• Reuse the reviewed shared runtime-binding helpers and assignment-target helper. Cache immutable provider and readonly facts while checking each current use's declaration order, provider role, alias depth, and shape guard afresh.
• Preserve all 62 original authored controls and both original corpus files. Add focused correctness, cold-work, cache-context, and targeted corpus regressions.

Test plan

• Current head 8201239e9b: 305 focused tests passed. All seven local checks passed, including 34,279 tests with 1,118 skips, typecheck, lint, formatting, registry generation, a forced serial build, and JSON report smoke. Lint retained two classified warnings in synthetic fixtures and none in changed production files. The unused fixture binding is cleaned up separately in FPFNFIXAPEX mark an unused native-path fixture binding #2111; the deliberate constant-reassignment control remains.
• Strict fuzzing: 500 iterations, seed 42, target firing required; 2,090 executions, 19 fires, zero findings. Aggregate firing does not establish coverage of every classifier branch.
• Built API and CLI scans each compared all 62 synthetic modules under target-only and default profiles. All eight scans and the comparator passed. Each profile changed from one to 16 target warnings: 15 whole findings added, none removed. The stable positive control and unrelated findings were preserved. Controlled React 18 host metadata is part of this evidence; filename- and unit-profile-specific controls carry separate qualifications.
• Remote sample parity against the exact PR-base cache completed across 20 project roots in six repositories: 1,721 analyzed files and 3,308 whole diagnostics unchanged; zero additions, removals, or skipped projects. One candidate evaluator invocation reused the baseline without rerunning it. Existing evaluator retries for failed or incomplete jobs remain enabled.

The sample does not establish full-corpus parity, target activation in every sampled project, or a performance improvement. Synthetic API/CLI scans do not execute application or provider code. This validation leaves the PR's existing readiness unchanged.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/eslint-plugin-react-doctor@2108

npm i https://pkg.pr.new/oxlint-plugin-react-doctor@2108

npm i https://pkg.pr.new/react-doctor@2108

commit: 8201239

[github-actions]

Interactive terminal E2E

Terminal Control verified the built CLI at 8201239 in a real PTY:

• selected a project interactively and observed Scanning... before the three-second Git delay completed
• waited for the clean result and exercised the compact report
• opened copy context and the GitHub Actions confirmation, then cancelled safely

Download the edited MP4 and PNG evidence